PT-2026-22391 · Unknown · Pillow Heif

Kaizawa97 · Publicado 2026-02-27 · Atualizado 2026-03-04 · CVE-2026-28231

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions pillow heif versions prior to 1.3.0

Description An integer overflow in the encode path buffer validation within pillow heif.c allows an attacker to bypass bounds checks by providing large image dimensions. This can lead to a heap out-of-bounds read, potentially resulting in information disclosure or denial of service. The issue triggers under default settings and does not require any special configuration.

Recommendations Update to pillow heif version 1.3.0 or later.

Exploit

Correção

DoS

Out of bounds Read

Integer Overflow

Enumeração de Fraquezas

CWE-125

CWE-190

Identificadores relacionados

CVE-2026-28231

GHSA-5GJJ-6R7V-PH3X

OPENSUSE-SU-2026:10285-1

Produtos afetados

Pillow Heif

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28231.json · Exploit
• https://github.com/bigcat88/pillow_heif/releases/tag/v1.3.0 · Nota
• https://github.com/bigcat88/pillow_heif/commit/8305a15d3780c533b762578cbe987d27a2c59c7a · Correção
• https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-28231 · Nota
• https://twitter.com/VulmonFeeds/status/2027630859835052189 · Publicação no Twitter
• https://osv.dev/vulnerability/openSUSE-SU-2026:10285-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28231 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027744245914775760 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28231 · Nota de Segurança
• https://t.me/cveNotify/154131 · Publicação no Telegram